Group signatures with verifier-local revocation

10 years 8 months ago
Group signatures with verifier-local revocation
Group signatures have recently become important for enabling privacy-preserving attestation in projects such as Microsoft's ngscb effort (formerly Palladium). Revocation is critical to the security of such systems. We construct a short group signature scheme that supports VerifierLocal Revocation (VLR). In this model, revocation messages are only sent to signature verifiers (as opposed to both signers and verifiers). Consequently there is no need to contact individual signers when some user is revoked. This model is appealing for systems providing attestation capabilities. Our signatures are as short as standard RSA signatures with comparable security. Security of our group signature (in the random oracle model) is based on the Strong DiffieHellman assumption and the Decision Linear assumption in bilinear groups. We give a precise model for VLR group signatures and discuss its implications.
Dan Boneh, Hovav Shacham
Added 20 Aug 2010
Updated 20 Aug 2010
Type Conference
Year 2004
Where CCS
Authors Dan Boneh, Hovav Shacham
Comments (0)